Traffic filtering service provided by QRATOR ensures the availability of Customer's information system (a website or a web service) affected by a DDoS attack, which may cause complete or partial unavailability of the web resource.

QRATOR traffic filtering service includes:

1. filtration of HTTPS traffic (subject to disclosure of SSL certificates).
2. analysis of inbound traffic of services using HTTP (including HTTPS services not requiring disclosure of SSL certificates).
3. analysis and protection of the service at transport and network level (IP, TCP, GRE, and MPLS).
4. admission of traffic arriving from "white listed" IP addresses.
5. blocking of traffic arriving from "black listed" IP addresses.
6. collection and visualization of statistical data, monthly incident reports generation.
7. export of blocked IP address list and expert investigation of DDoS attack for future prosecution by enforcement authorities (on demand).
8. DDoS traffic filtration bandwidth is determined by the selected Rate Schedule. Exceeding traffic limit is paid additionally.

Key benefits of QRATOR

1. Maximum network training time of 30 minutes.
2. QRATOR network consists of an array of interchangeable filtration nodes located at sites of major providers of Russia and West Europe. High resilience of the network makes it possible to remain under a DDoS attack continually and support operation of protected services.
3. All QRATOR filtration nodes announce IP address of the protected website using BGP Anycast mechanism. QRATOR developed and operates an intelligent traffic routing policy management system.
4. Query classification is based on behavior analysis, simulation of interaction of legitimate users with the protected resource and generation of attack signatures.
5. Query blocking is performed only in the event of a problem of the protected resource, which ensures minimal frequency of false responses.

Traffic filtering service provided by Kaspersky Lab ensures the availability of a Customer's information system (websites or web services) affected by DDoS attack, which may cause complete or partial unavailability of the web resource.

Kaspersky Lab's traffic filtering service includes:

1. filtration of HTTPS traffic (subject to disclosure of SSL certificates);
2. analysis of inbound traffic of services using HTTP (including HTTPS services not requiring disclosure of SSL certificates);
3. analysis and protection of services at transport and network level (IP, TCP, GRE, MPLS, etc.);
4. admission of traffic arriving from "white listed" IP addresses;
5. blocking of traffic arriving from "black listed" IP addresses;
6. collection and visualization of statistical data, monthly incident reports generation;
7. export of blocked IP address list and expert investigation of DDoS attack for future prosecution by enforcement authorities (on demand);
8. 1. Maximum DDoS traffic filtration bandwidth is limited by the conditions listed below, this traffic does not require additional payment: the service ensures traffic screening of 98% of instances provided DDoS attack does not exceed the limit of
   • up to 500 Gb/s – for UDP and ICMP-based attacks;
   • up to 20 Gb/s (or 25 mil. data packets/s) – for TCP, IPSEC, GRE and other types of attacks.
   If the limit is exceeded, traffic is not processed (it is blocked completely).

Key benefits of the Kaspersky Lab service

1. Generation of statistical profile for the traffic of a specific resource, which gives individual protection;
2. Geographically distributed components of the service are connected to the Net via heavy-duty communication channels eliminating the possibility of their simultaneous failure in the event of an attack. The service is not dependent on any specific provider, which increases its reliability and resilience;
3. Kaspersky Laboratory possesses vast experience in combating bot nets, which from the prerequisite for any major DDoS attack. Kaspersky's framework includes a team studying and counteracting zombie nets to provide Kaspersky up-to-the minute information on the methods used by intruders and enable effective counteraction;
4. System components employ a variety of static, signature, behavioral and other methods of traffic filtering making it possible to protect resources even from complex intelligent attack, which might defeat other defenses.
5. The system includes the function of attack detection using SENSORs located in close proximity to the protected resource allowing to react to any traffic variations immediately (statistical profile of customer's traffic is analyzed instead of traffic itself).